xref: /freebsd/crypto/openssh/sftp-realpath.c (revision e9e8876a)
1 /*	$OpenBSD: sftp-realpath.c,v 1.2 2021/09/02 21:03:54 deraadt Exp $ */
2 /*
3  * Copyright (c) 2003 Constantin S. Svintsoff <kostik@iclub.nsu.ru>
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. The names of the authors may not be used to endorse or promote
14  *    products derived from this software without specific prior written
15  *    permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include "includes.h"
31 
32 #include <sys/types.h>
33 #include <sys/stat.h>
34 
35 #include <errno.h>
36 #include <stdlib.h>
37 #include <stddef.h>
38 #include <string.h>
39 #include <unistd.h>
40 #include <limits.h>
41 
42 #ifndef SYMLOOP_MAX
43 # define SYMLOOP_MAX 32
44 #endif
45 
46 /* XXX rewrite sftp-server to use POSIX realpath and remove this hack */
47 
48 char *sftp_realpath(const char *path, char *resolved);
49 
50 /*
51  * char *realpath(const char *path, char resolved[PATH_MAX]);
52  *
53  * Find the real name of path, by removing all ".", ".." and symlink
54  * components.  Returns (resolved) on success, or (NULL) on failure,
55  * in which case the path which caused trouble is left in (resolved).
56  */
57 char *
sftp_realpath(const char * path,char * resolved)58 sftp_realpath(const char *path, char *resolved)
59 {
60 	struct stat sb;
61 	char *p, *q, *s;
62 	size_t left_len, resolved_len;
63 	unsigned symlinks;
64 	int serrno, slen, mem_allocated;
65 	char left[PATH_MAX], next_token[PATH_MAX], symlink[PATH_MAX];
66 
67 	if (path[0] == '\0') {
68 		errno = ENOENT;
69 		return (NULL);
70 	}
71 
72 	serrno = errno;
73 
74 	if (resolved == NULL) {
75 		resolved = malloc(PATH_MAX);
76 		if (resolved == NULL)
77 			return (NULL);
78 		mem_allocated = 1;
79 	} else
80 		mem_allocated = 0;
81 
82 	symlinks = 0;
83 	if (path[0] == '/') {
84 		resolved[0] = '/';
85 		resolved[1] = '\0';
86 		if (path[1] == '\0')
87 			return (resolved);
88 		resolved_len = 1;
89 		left_len = strlcpy(left, path + 1, sizeof(left));
90 	} else {
91 		if (getcwd(resolved, PATH_MAX) == NULL) {
92 			if (mem_allocated)
93 				free(resolved);
94 			else
95 				strlcpy(resolved, ".", PATH_MAX);
96 			return (NULL);
97 		}
98 		resolved_len = strlen(resolved);
99 		left_len = strlcpy(left, path, sizeof(left));
100 	}
101 	if (left_len >= sizeof(left) || resolved_len >= PATH_MAX) {
102 		errno = ENAMETOOLONG;
103 		goto err;
104 	}
105 
106 	/*
107 	 * Iterate over path components in `left'.
108 	 */
109 	while (left_len != 0) {
110 		/*
111 		 * Extract the next path component and adjust `left'
112 		 * and its length.
113 		 */
114 		p = strchr(left, '/');
115 		s = p ? p : left + left_len;
116 		if (s - left >= (ptrdiff_t)sizeof(next_token)) {
117 			errno = ENAMETOOLONG;
118 			goto err;
119 		}
120 		memcpy(next_token, left, s - left);
121 		next_token[s - left] = '\0';
122 		left_len -= s - left;
123 		if (p != NULL)
124 			memmove(left, s + 1, left_len + 1);
125 		if (resolved[resolved_len - 1] != '/') {
126 			if (resolved_len + 1 >= PATH_MAX) {
127 				errno = ENAMETOOLONG;
128 				goto err;
129 			}
130 			resolved[resolved_len++] = '/';
131 			resolved[resolved_len] = '\0';
132 		}
133 		if (next_token[0] == '\0')
134 			continue;
135 		else if (strcmp(next_token, ".") == 0)
136 			continue;
137 		else if (strcmp(next_token, "..") == 0) {
138 			/*
139 			 * Strip the last path component except when we have
140 			 * single "/"
141 			 */
142 			if (resolved_len > 1) {
143 				resolved[resolved_len - 1] = '\0';
144 				q = strrchr(resolved, '/') + 1;
145 				*q = '\0';
146 				resolved_len = q - resolved;
147 			}
148 			continue;
149 		}
150 
151 		/*
152 		 * Append the next path component and lstat() it. If
153 		 * lstat() fails we still can return successfully if
154 		 * there are no more path components left.
155 		 */
156 		resolved_len = strlcat(resolved, next_token, PATH_MAX);
157 		if (resolved_len >= PATH_MAX) {
158 			errno = ENAMETOOLONG;
159 			goto err;
160 		}
161 		if (lstat(resolved, &sb) != 0) {
162 			if (errno == ENOENT && p == NULL) {
163 				errno = serrno;
164 				return (resolved);
165 			}
166 			goto err;
167 		}
168 		if (S_ISLNK(sb.st_mode)) {
169 			if (symlinks++ > SYMLOOP_MAX) {
170 				errno = ELOOP;
171 				goto err;
172 			}
173 			slen = readlink(resolved, symlink, sizeof(symlink) - 1);
174 			if (slen < 0)
175 				goto err;
176 			symlink[slen] = '\0';
177 			if (symlink[0] == '/') {
178 				resolved[1] = 0;
179 				resolved_len = 1;
180 			} else if (resolved_len > 1) {
181 				/* Strip the last path component. */
182 				resolved[resolved_len - 1] = '\0';
183 				q = strrchr(resolved, '/') + 1;
184 				*q = '\0';
185 				resolved_len = q - resolved;
186 			}
187 
188 			/*
189 			 * If there are any path components left, then
190 			 * append them to symlink. The result is placed
191 			 * in `left'.
192 			 */
193 			if (p != NULL) {
194 				if (symlink[slen - 1] != '/') {
195 					if (slen + 1 >=
196 					    (ptrdiff_t)sizeof(symlink)) {
197 						errno = ENAMETOOLONG;
198 						goto err;
199 					}
200 					symlink[slen] = '/';
201 					symlink[slen + 1] = 0;
202 				}
203 				left_len = strlcat(symlink, left, sizeof(symlink));
204 				if (left_len >= sizeof(symlink)) {
205 					errno = ENAMETOOLONG;
206 					goto err;
207 				}
208 			}
209 			left_len = strlcpy(left, symlink, sizeof(left));
210 		}
211 	}
212 
213 	/*
214 	 * Remove trailing slash except when the resolved pathname
215 	 * is a single "/".
216 	 */
217 	if (resolved_len > 1 && resolved[resolved_len - 1] == '/')
218 		resolved[resolved_len - 1] = '\0';
219 	return (resolved);
220 
221 err:
222 	if (mem_allocated)
223 		free(resolved);
224 	return (NULL);
225 }
226